Sub-processor List
Effective date: 2026-06-15 Last updated: 2026-08-15
To deliver Essence.Report, Cobalt Stream Technologies LLC engages third parties ("Sub-processors") that process Customer Personal Data on our behalf. Before engaging any Sub-processor, we conduct diligence on its privacy, security, and confidentiality practices and put in place a data-protection agreement imposing obligations no less protective than those in our Data Processing Addendum.
This list supports § 4 of our Privacy Policy and § 7 of our DPA.
Current sub-processors
| Sub-processor | Purpose | Region | Transfer safeguard |
|---|---|---|---|
| Clerk | Authentication and account security | United States | SCCs, DPA |
| Stripe | Subscription billing and payments | United States / global | PCI-DSS, SCCs, DPA |
| Akamai Technologies (Linode) | Backend hosting and data storage | Japan (Tokyo) | EU adequacy decision (Japan), DPA |
| Vercel | Frontend hosting and content delivery | United States / global | SCCs, DPA |
| Upstash | Session cache and rate-limit data | Global (configurable) | SCCs, DPA |
| Sentry | Error monitoring (PII-redacted) | United States | SCCs, DPA |
| PostHog | Anonymised product analytics (optional) | EU or United States | SCCs, DPA |
| First-party AI model providers * | Generate AI responses via large language model APIs | United States and other | SCCs/DPA; contractually prohibited from training on Customer Content |
| Web search & retrieval provider * | Retrieve publicly available sources at query time | United States / global | DPA |
* To protect commercially sensitive information about how the Service produces Reports, the specific identities of our AI model providers and our web-retrieval provider are disclosed to Customers under a non-disclosure agreement on request. This preserves the confidentiality of our model and retrieval design while giving controllers the information they need for their own compliance.
Changes to this list
We will give Customers at least 14 days' notice before adding or replacing a Sub-processor that processes Customer Personal Data (DPA § 7.2). Customers may object on reasonable data-protection grounds; if we cannot address the objection, the Customer may terminate the affected portion of the Agreement.
To receive advance notice of Sub-processor changes, or to request the NDA-protected details in the note above, contact privacy@essence.report.
Contact
| Topic | |
|---|---|
| Sub-processor list, change notifications, objections | privacy@essence.report |
| DPA and contractual matters | legal@essence.report |